# SideCopy APT Expands Targets to Indian Academic Institutions with Advanced Malware The advanced persistent threat (APT) group known as **SideCopy** has been observed expanding its target demographic, moving beyond its traditional focus on government entities to include academic institutions in India. This strategic shift highlights the group's adaptability and ongoing efforts to refine its cyber espionage operations. ## Spear-Phishing Campaigns Remain Core Tactic **Trellix** researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C detailed **SideCopy**'s latest campaign, noting that operations typically begin with highly targeted spear-phishing. These campaigns exploit `mshta.exe` to execute malicious scripts, effectively bypassing standard security protocols and facilitating the deployment of a robust remote access trojan (RAT). > "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers said in a technical report.  ## Evolution of a Notorious APT Active since at least 2019, **SideCopy** (also known as **TAG-140**) is a Pakistani-origin APT group with known overlaps with the **Transparent Tribe** cluster. Historically, the group has primarily focused on Indian defense forces and government officials. Previous reports, such as one from **Seqrite Labs** in June 2026, linked **SideCopy** to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with the open-source **Xeno RAT**. ## Intricate Attack Chain Detailed The latest attack chain documented by **Trellix** begins with a weaponized ZIP archive delivered via spear-phishing. Inside, victims find a Windows shortcut (LNK) file, disguised with a spoofed PDF icon and a `.DOCX` extension (e.g., "commskll.docx.lnk") to appear legitimate. Executing this LNK file triggers the fetching of an obfuscated HTML Application (HTA) from a remote server (**docsportal[.]in**). This HTA is then executed using `mshta.exe`, leading to the reflective loading of a DLL payload. A notable anti-forensic measure includes a self-deletion routine that removes the HTA file once the subsequent stage is initialized.  ## Multi-Stage Payload Delivery The initial DLL acts as a dropper for three embedded components: * `appT.bat`: A batch script launched via a Windows Registry Run Key to execute `startT.hta` using `mshta.exe` without user interaction. * `startT.hta`: A secondary exploit stage containing the final, heavily obfuscated payload. * `commskl.docx`: A decoy document displayed to the user to maintain cover. **Trellix** explains that the obfuscated code within `startT.hta` undergoes a multi-stage deobfuscation process to reconstruct a two-part XAML payload directly in memory. This process then reflectively loads an embedded DLL, `ioluegnt.dll`. > "To evade disk-based detection, the malware decodes its core payload into volatile memory space, transitioning from a Base64-encoded string to an active, in-memory process via .NET Deserialization." ## ReverseRAT: The Core Payload The final DLL is identified as **ReverseRAT**, a remote access trojan that **SideCopy** has utilized since early 2021. **ReverseRAT** is highly capable, designed for extensive data exfiltration, remote execution, and persistence. Its functionalities include: * Gathering system metadata and installed software lists. * Capturing screenshots and passwords. * Exfiltrating clipboard content. * Performing file operations and running arbitrary commands. * Establishing persistence via Registry modifications. * Uploading files and spawning shell sessions. Command-and-control (C2) traffic is encrypted using a hard-coded key (**NMXIKS09?:709,!~lnsYUS**). Harvested data is exfiltrated via port 5863 to **dns.educationportals[.]biz**, which resolves to the IP address **45.61.157[.]22**. ## Expanding Strategic Priorities **Trellix** concludes that **SideCopy**'s current activities underscore a disciplined and highly strategic approach to intelligence collection. The pivot toward academic institutions, in addition to their historical focus on government entities, signals an expanding set of strategic priorities for the group. > "By continuously refining their infection stages, most notably through the heavy abuse of mshta.exe and complex, multilayered obfuscation, they remain a formidable and adaptive adversary for regional security."